From 6c779595e1d5fc0b35daedfa4553e3e21f44da27 Mon Sep 17 00:00:00 2001 From: mos-dt-0 Date: Sat, 1 Aug 2026 08:13:12 -0500 Subject: [PATCH] =?UTF-8?q?docs(remediation):=20rotation=20checkpoint=20?= =?UTF-8?q?=E2=80=94=20board=20rebuilt=20for=20a=20cold=20read,=20three=20?= =?UTF-8?q?stale=20restatements=20removed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Orchestrator rotating at ~803k tokens (~4x threshold). A mission built on rotation-not-compaction should not run its own coordinator past it. Board rewritten as the rehydration artifact: in-flight state, a read-this-first block for the incoming seat, and the live rulings it most needs. Under the 8KB cap. AUDIT AT THE SEAM found THREE stale restatements on this board, each of which would have misled the incoming orchestrator: 1. the delivery-gate list still OMITTED the merge-gate verdict step (the D-26 defect itself, still sitting on the board after MISSION.md was corrected); 2. capability described as 'token-file set = authoritative registry', superseded by D-13/D-15 (capability is per-path; assert permissions.push as that seat); 3. Sequencing still said DECISION-1 was CONTESTED and 'do not treat it as settled' hours after it was RULED — an incoming seat would have re-litigated a closed decision. All three were restatements of text owned elsewhere. Replaced with references, per the mission's own render-not-restate principle: a second copy is a second thing to go stale, and this board proved it three times in one night. Co-Authored-By: Claude Opus 5 (1M context) --- docs/remediation/BOARD.md | 129 +++++++++++++++++--------------------- 1 file changed, 57 insertions(+), 72 deletions(-) diff --git a/docs/remediation/BOARD.md b/docs/remediation/BOARD.md index 08435a7e..73420ef2 100644 --- a/docs/remediation/BOARD.md +++ b/docs/remediation/BOARD.md @@ -1,7 +1,7 @@ # mos-remediation — LIVE BOARD (keep < 8 KB) -**Phase:** EXECUTING — RM-03 **GATE-READY**, merge-gate assigned, HELD for Jason. RM-02 CI in flight. -**Updated:** 2026-07-31 (mos-remediation orchestrator; seat active on `mosaic-fleet`). +**Phase:** EXECUTING — RM-03 at owner-merge; RM-02 blocked on RM-61; RM-61 building. +**Updated:** 2026-08-01 — **ORCHESTRATOR ROTATION SEAM** (prior seat rotated at ~803k tokens, ~4x threshold). ## Head @@ -16,49 +16,43 @@ ## In-flight -| Task | Owner | State | -| ------------------------------ | ------------- | ------------------------------------------------------------------------------------ | -| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | -| RM-03 queue guard | merge-gate | **GATE-READY** @ `78ec47cd` — rev-974 APPROVED (id 66) + CI 9/9 JSON; HELD for Jason | -| RM-02 gate registry ★keystone | f10-coder | masking blocker fixed @ `f9746b23`; CI #2187 running; **not** gate-ready | -| RM-61 terminal-green exemption | unassigned | ruled B; negative control FIRST, then adopt — or fall to A | -| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** | -| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes it | +| Task | Owner | State | +| ----------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| RM-01 reproducible checkout | — | **MERGED** `f58b3699` (#1027) | +| RM-03 queue guard | **Jason** | **merge-gate GO** @ `78ec47cd` (comment 20392) — **HELD FOR OWNER MERGE**. Head verified unmoved; GO is commit-bound and VOID if it moves — **do not push to #1032** | +| RM-02 gate registry ★keystone | — | **BLOCKED on RM-61.** Code complete @ `f9746b23`, own harness green in CI, 2 reviews clear, head FROZEN. Cannot certify terminal-green: `ci-postgres` FAIL on #2187 **and** #2188 | +| RM-61 CI-contract exemption | coder-mos1 | design APPROVED, **building**. Controls first → prove discrimination → then exempt | +| RM-59 / RM-60 | Jason (infra) | tracked deps; RM-60 option **B** (A does not fix the ordering defect) | +| #1023 queue-guard attempt | Jason | SUPERSEDED-PENDING-JASON — RM-03 supersedes; live REQUEST_CHANGES, do **not** merge | -**RM-03 gate-ready evidence** (each element observed, not relayed): head triple all equal at -`78ec47cd97bf0abc49334401f08c5b86e5be3a1a`; latest review **id 66 APPROVED at the current head** (id 64 -`REQUEST_CHANGES` correctly superseded); `Closes #1019`; CI #2186 **9/9 JSON child-step scan**, confirmed -independently by two observers whose counts **agreed**. Reviewer attacked rather than read — real-failure -payload → exit 3 `ASSERTED_NOT_READY`, bypass re-attack rejected, 170 KiB payload rc0, both tri-state arms. +### For the incoming orchestrator — read this before acting -> ⚠ **The queue guard is still inert for this merge** — RM-03 _is_ the fix and is not merged. The gate -> records `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. -> **The last merge to pass through the broken gate is the one that fixes it.** After #1032 lands, that -> field becomes real evidence for the first time since it was written. +1. **Nothing is waiting on you that is urgent.** RM-03 waits on Jason; RM-02 waits on RM-61; RM-61 is + building. Read the record before touching any lane. +2. **`docs/remediation/TASKS.md` is authoritative**, not the newest voice in a chat. It holds 35 findings + (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in TASKS.md), every ruling with its rationale, and the + requirements each finding placed on RM-02/RM-34/RM-50/RM-55. +3. **`MISSION.md` carries five first-class principles**, all earned by live failures — observe the + property not the proxy · pre-registration prevents retrofitting and nothing else · never ship an + integrity claim dressed as a property · when a property cannot exist at its layer, bound it and track + the real guarantee · query for refutation, never for confirmation · redundant observation on + evidence-bearing steps. +4. **Seat identity:** `export MOSAIC_GIT_IDENTITY=` is stripped by a context reset (**D-34**) — + every dispatch/rehydration brief must re-export it, or the seat cannot use its credentials. +5. **Scan CI from `-f json`, never default text** — text mode omits `clone` (**D-33**). State counts. +6. **The queue guard is zero-information until RM-03 merges** (**D-23**) — never cite its green. +7. **The bounded CI re-roll used on RM-02 was a one-time stopgap, NOT policy.** A per-PR free re-roll is + D-21 normalisation. Do not repeat it; RM-61 is the fix. -## Delivery gates — DOCTRINE CHANGE 2026-08-01 +## Delivery gates — REFERENCE, do not restate -**The gate definition was incomplete from mission setup: the merge-gate verdict step was missing.** -Root cause (**D-26**): the gates were **restated from memory** into `MISSION.md`/`KICKSTART.md` instead of -**referenced**, and the omission propagated into every worker brief issued since. It then recurred _inside -the correction_ — which dropped five details including a security precondition and cited a file that does -not exist. +Canonical: `~/.config/mosaic/fleet/roles.local/merge-gate.md` (verdict authority) and +`~/.config/mosaic/fleet/roles/validator.md`. Order + the freeze/zero-information rules are stated once in +[`MISSION.md`](./MISSION.md) and [`KICKSTART.md`](./KICKSTART.md) — **read them there.** -**Fix is render-not-restate, mechanically.** `MISSION.md` and `KICKSTART.md` now **reference** -`~/.config/mosaic/fleet/roles.local/merge-gate.md` and `~/.config/mosaic/fleet/roles/validator.md` and -state only the gate **order**: - -> independent review (author ≠ reviewer) → remediation → **CI terminal-green at the exact head, full step -> scan** → **merge-gate verdict `GO`/`NO-GO`/`HOLD`** (commit-bound; **VOID on head move**; posted durably -> with enumerated evidence under its own minted identity) → **coordinator head-pinned merge** - -- **After a `GO`, pushes freeze** — a doc tweak voids the verdict. Gate-ready is a **freeze point**. -- The coordinator assigns the gate seat; the orchestrator owns getting a PR _gate-ready_. -- **Queue guard is ZERO-INFORMATION until RM-03 lands** (D-23) — record it as - `queue-guard: ZERO-INFORMATION (inert, D-23, owner RM-03)`. _A mandated field must not become a - manufactured one._ -- Gate seat identity: `gitea-mosaicstack-merge-gate` minted least-privilege, verified `push=False` — - it structurally cannot merge. +This board deliberately does **not** repeat the gate definition: restating it from memory is exactly how +the merge-gate step went missing from mission setup in the first place (**D-26**), twice, including once +inside the correction for it. ## Fleet seats @@ -70,48 +64,39 @@ state only the gate **order**: ## Gate status -- Delivery gates active: author≠reviewer, diff-blind pre-registered checks, CI-green, merged-PR completion. - Freeze: LIFTED for this workstream only. -- Git identity: `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what +- Git identity: orchestrator runs `MOSAIC_GIT_IDENTITY=mos-dt-0` INTERIM. Mos ruled gate-16 HOLDS (author≠reviewer is what gate-16 protects; rev-974 reviews, mos-dt-0 never self-reviews). Dedicated identity TRACKED, Mos provisions. -- Capability check (D-11b): before dispatching seat X to provider Y, verify - `~/.config/mosaic/secrets/gitea-tokens/gitea--.token` exists. Token-file set = authoritative - capability registry. Mos owns provisioning; escalate missing pairs to him. +- Capability is **per-path** (D-11b → **superseded in part by D-13/D-15**): a token file is **necessary, + not sufficient**. Three layers — token file (raw-API), `tea` login (tea paths), **repository permission** + (writes). Before dispatch, assert `permissions.push == true` **as that seat**, not token existence and + not a 200 on a read. Mos owns provisioning; escalate missing pairs. - Seat identity (D-11a): token identity AND `git config user.name`/`user.email` must BOTH be set and agree. Exporting `MOSAIC_GIT_IDENTITY` alone does NOT fix commit authorship. -- Standing worker-brief doctrine (accreted, mandatory in every brief): don't weaken a RED test to make - it pass; if a check is unrunnable as written SAY SO, never silently substitute; `agent-send -f` never - `-m`; heavy artifacts off shared `/tmp`. +- Standing worker-brief doctrine (mandatory in EVERY brief): re-export `MOSAIC_GIT_IDENTITY` (**D-34**); + commit early/WIP (**D-31**); don't weaken a RED test to pass; if a check is unrunnable SAY SO, never + substitute; `agent-send -f` never `-m`; artifacts off shared `/tmp`; scan CI from `-f json` (**D-33**). - Remote control: native `/remote-control` NOT wired in this runtime. Path is **Mos-relay** (Jason ↔ mos-claude via Discord ↔ mos-remediation via agent-send). Not a blocker. -## Sequencing (from MISSION.md) +## Sequencing — see [`MISSION.md`](./MISSION.md) -1. Spine + choke-point service (MACP wiring @ mosaic_orchestrator.py::run_single_task) + PG/Redis - ⚠ **CONTESTED — see DECISION-1.** Both planners independently reject this wire-in point: that - controller is `"enabled": false` and references a dispatcher that does not exist here. Charter text - left UNCHANGED pending Mos/Jason ruling; do not treat it as settled. -2. Rotation daemon (finish Mission Control Plane, reuse packages/coord) -3. Comms service (envelope→service→PG/Redis→adapters) -4. Hygiene + conformance harness - Cross-cutting retirements: flat-file tracking, 3 MACP islands, silent MOSAIC BYPASS. +Builds 1-5 and the cross-cutting retirements are stated once in the charter. **Not repeated here.** -## Dogfood evidence — live failure classes, not hypotheticals +⚠ **DECISION-1 is RULED, not contested** (this board previously said otherwise — stale for hours after the +ruling). The choke point targets a **new production Node `TaskExecutor` on the LIVE dispatch path** +(`packages/mosaic` launch + `packages/coord`); the disabled Python rail is **deleted, not ported**. -> Newest first. Oldest entries roll to `BOARD-LEDGER.md` via `board-roll.sh` when this file -> exceeds its 8 KB cap. Keystone detail is duplicated in `TASKS.md` §1a, so rolling loses nothing. +## Decisions log — full record in [`TASKS.md`](./TASKS.md) - +All 35 findings (D-1…D-6 in `BOARD-LEDGER.md`, D-7…D-35 in `TASKS.md`) and every ruling with its +rationale live there. **Not duplicated here** — a second copy is a second thing to go stale, which this +board has now done three times in one night (gate list, capability registry, DECISION-1 status). - +Live rulings a fresh seat most needs: -## Decisions log - -- 2026-07-31 — Mission set up by Mos post-postmortem (15/15 decided). Dogfood posture active. -- 2026-07-31 — Mos: stale `.mosaic/orchestrator/mission.json` is RESIDUE of the disabled Python - orchestrator rail that this plan RETIRES. Do NOT invest in it; do NOT build on that rail. The 0/0 - milestone banner is cosmetic. (Supersedes any plan to repair it.) -- 2026-07-31 — Mos: planners must be dispatched with GUARANTEED clean context, not requested-clean. - Prior default-socket planner sessions predate this mission; dirty context is the indicted hygiene. -- 2026-07-31 — mos-remediation: worker briefs forbid all git ops and restrict each worker to a single - named output file, so two planners can share one checkout without a branch race (M2-era incident doctrine). +- **D-23** queue guard is inert → zero-information until RM-03 merges. Never cite its green. +- **D-33** scan CI from `-f json`; text mode omits `clone`. State counts. +- **D-34** a context reset strips `MOSAIC_GIT_IDENTITY` → re-export in every brief. +- **RM-61** exemption: controls FIRST, prove discrimination, THEN adopt — or fall to option A. +- The RM-02 bounded CI re-roll was a **one-time stopgap, never policy**.